AZ-400 Practice Test 34 — 15 Questions

Question 1

Your organization uses GitHub for code and GitHub Actions for CI/CD. You want to enforce that all workflows include a 'codeql-analysis' job for security scanning. What is the best approach?

Accepted Answer

Use GitHub's required workflows feature to mandate specific workflows. GitHub's required workflows feature allows organization owners to enforce that specific workflows (like a CodeQL analysis) run on all repositories in the organization, ensuring consistent security scanning without relying on templates or manual setup. This is the only approach that centrally mandates the workflow's presence and execution across all repositories, even if developers create new workflows or modify existing ones.

Answer

Create a workflow template and add it to the organization's workflow templates directory

Answer

Use branch protection rules to require a status check named 'codeql-analysis'

Answer

Create a custom GitHub Action that runs CodeQL and require it in all workflows

Question 2

Your team is adopting GitHub Copilot for code generation. The compliance team requires that all code generated by AI is reviewed and that proprietary code is not used as training data. Which TWO settings should you configure in your GitHub organization?

Accepted Answer

Configure a branch protection rule that requires all code to be reviewed before merging.. Branch protection rules enforce mandatory pull request reviews before merging, which satisfies the compliance requirement that all AI-generated code must be reviewed by a human before entering the main branch. Additionally, disabling the 'Allow GitHub to use my data for training' option in the organization's Copilot settings prevents proprietary code from being used as training data, directly addressing the compliance requirement that proprietary code not be used for training. Together, these two settings allow the team to use GitHub Copilot safely while meeting compliance.

Answer

Disable Copilot for all repositories in the organization.

Answer

Enable 'Suggestions matching public code' to block suggestions that match public code.

Answer

Enable 'Allow GitHub to use my code snippets for product improvements' to improve Copilot.

Question 3

You have a classic release pipeline that deploys to Azure App Service. You need to implement a canary deployment strategy where 10% of traffic is routed to the new version for 30 minutes before full rollout. What should you use?

Accepted Answer

Deploy to a staging slot and then use Azure CLI to update routing rules after deployment.. Canary deployment on Azure App Service is achieved by deploying to a deployment slot and then configuring routing rules to send a percentage of traffic to that slot. In a classic release pipeline, you can use the Azure App Service deploy task to deploy to a slot, followed by an Azure CLI task to set the traffic percentage (e.g., az webapp traffic-routing set). The 'Swap with preview' feature is for multi-phase swap validation, not for setting traffic percentages.

Answer

Configure multiple deployment slots and use Traffic Manager to distribute traffic.

Answer

Use the 'Azure App Service deploy' task with the 'Deploy to Slot' option, then manually adjust routing rules.

Answer

Use slot swap with 'Swap with preview' and set traffic percentage in the swap settings.

Question 4

Which TWO practices help improve the security of container images in a CI/CD pipeline? (Choose two.)

Accepted Answer

Sign container images to verify their integrity.. Signing container images (Option C) ensures their integrity and authenticity by allowing the CI/CD pipeline to verify that the image has not been tampered with since it was signed, typically using tools like Docker Content Trust (DCT) or Notary. Scanning container images for vulnerabilities (Option E) during the build identifies known security issues in the image layers and dependencies, allowing teams to remediate before deployment. Both practices are essential for supply chain security. The other options are incorrect: running as root increases risk, public registries expose images, and 'latest' tags cause unpredictable updates.

Answer

Run containers with root privileges to avoid permission issues.

Answer

Store container images in a public registry for easy access.

Answer

Use the 'latest' tag for base images to always get the newest patches.

Question 5

You have the YAML pipeline exhibit above. The pipeline fails with: 'The pipeline is not valid. Could not find the template file shared-templates/build-steps.yml.' What is the most likely cause?

Accepted Answer

The template path is incorrect because it should be relative to the repository root; the repository name is 'myorg/shared-templates', so the path should be 'build-steps.yml'.. When referencing a template from another repository in Azure Pipelines, the `repository` property specifies the repository name (e.g., `myorg/shared-templates`), and the template path must be relative to the root of that repository. The error indicates the pipeline cannot find the file, meaning the path `shared-templates/build-steps.yml` is incorrect; it should be just `build-steps.yml` since the repository name is already declared in the `repository` field. The path should not include the repository name again.

Answer

The checkout step for 'shared-templates' must be before the template reference, which it is.

Answer

The template file is missing from the shared-templates repository.

Answer

The ref 'refs/heads/main' does not exist in the shared-templates repository.

Question 6

The exhibit shows a draft Azure Monitor alert rule for Key Vault secret expiry. However, the query fails to return results for secrets that have already expired. What is the most likely reason?

Accepted Answer

The condition `DaysToExpiry > 0` excludes secrets that have already expired.. The query filters on `DaysToExpiry > 0`, which only returns secrets with a positive number of days remaining until expiry. Once a secret has expired, its `DaysToExpiry` becomes zero or negative, so it is excluded from the results. This is a logical filter error: the condition should be `DaysToExpiry <= 0` or remove the filter entirely to include expired secrets.

Answer

The query does not include secrets that have no expiry date set.

Answer

The query only checks secrets that are enabled.

Answer

The `limit 10` clause restricts to only 10 secrets, which may miss expired ones.

Question 7

Your team uses GitHub Actions for CI/CD. You want to automatically deploy to Azure App Service whenever a pull request is merged to the main branch. Which event trigger should you use in the GitHub Actions workflow?

Accepted Answer

push: branches: [main]. In GitHub Actions, merging a pull request into `main` results in a `push` event to `main`. The `push` trigger with `branches: [main]` therefore correctly fires whenever a PR is merged. `pull_request: types: [closed]` fires on any PR closure, whether merged or not, so it would deploy even when a PR is closed without merging. To use `pull_request` for merges, you would need an additional `if: github.event.pull_request.merged == true` check, but the question asks for the event trigger alone.

Answer

pull_request: branches: [main]

Answer

pull_request: types: [closed] branches: [main]

Answer

release: types: [published]

Question 8

Your team is migrating from on-premises TFS to Azure DevOps Services. You need to ensure that all existing work item history and attachments are preserved. Which migration approach should you use?

Accepted Answer

Use the Azure DevOps Migration Tools (open source). The Azure DevOps Migration Tools (an open-source project) are specifically designed to migrate work items, including history, attachments, and links, from on-premises TFS to Azure DevOps Services. These tools handle the complex data transformations required to preserve the full fidelity of work item data, which is not possible with simpler export/import methods.

Answer

Export to Excel and import using Azure DevOps Office Integration

Answer

Manually recreate work items in Azure DevOps

Answer

Use the Azure DevOps REST API to migrate work items

Question 9

Your team uses GitHub Actions for CI/CD. You want to reuse a workflow across multiple repositories without duplicating code. Which approach should you use?

Accepted Answer

Create a reusable workflow in a central repository and reference it using 'uses: owner/repo/.github/workflows/workflow.yml@ref'.. GitHub Actions supports reusable workflows that allow you to define a workflow in a central repository and reference it from other repositories using the 'uses' syntax with the format 'owner/repo/.github/workflows/workflow.yml@ref'. This eliminates code duplication while maintaining a single source of truth for the workflow logic, and the referenced workflow can be triggered by events in the caller repository.

Answer

Store the workflow in a shared repository and use environment secrets to share credentials.

Answer

Create a composite action and reference it from each workflow.

Answer

Create a workflow template in the organization's .github repository.

Question 10

Your team uses Azure Boards and wants to automate work item state transitions when code is merged. What should you use?

Accepted Answer

GitHub + Azure Boards integration with automatic work item linking. GitHub + Azure Boards integration, when configured with automatic work item linking, automatically transitions work items (e.g., from 'Active' to 'Resolved') when a pull request is merged. This is achieved through the integration's ability to detect commit messages or PR descriptions containing 'AB#{ID}' or 'Fixes AB#{ID}' patterns, which trigger state changes defined in the Azure Boards project configuration.

Answer

Azure Pipelines with 'Update work item' task

Answer

Branch policy in Azure Repos

Answer

Power Automate with Azure DevOps connector

Question 11

Refer to the exhibit. An engineer tries to add a custom script extension to a VMSS but gets a ResourceNotFound error. What is the most likely cause?

Accepted Answer

The VMSS does not exist in the specified resource group.

Answer

The script URL is inaccessible due to network restrictions.

Answer

The CustomScript extension is not supported on this VMSS SKU.

Answer

The VMSS is in a different region than the resource group.

Question 12

Your team is adopting Azure Pipelines for a new project. You need to ensure that only authorized users can approve releases to production. Which two methods can you use to implement approval checks?

Accepted Answer

Configure pre-deployment approvals on the Production environment.. Pre-deployment approvals on the Production environment (Option A) allow you to require one or more users or groups to approve a release before it is deployed to that environment. Similarly, setting the 'Required approvers' field on the environment (Option C) specifies the users or groups that must approve the deployment, which is another native Azure Pipelines approval mechanism. Both enforce authorization at the environment level, ensuring only designated approvers can promote a release to production.

Answer

Use Deployment Gates with a manual approval gate.

Answer

Add a Manual Intervention task in the release pipeline.

Answer

Add an Approval Check to the agent pool.

Question 13

A DevOps engineer needs to ensure that only approved Azure Resource Manager (ARM) templates are used for deployments. They want to enforce this at the subscription level. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. You can define a custom policy to audit or deny resources that do not contain metadata indicating they were deployed from an approved ARM template. Azure Policy evaluates all resource creation and update requests against these rules, blocking or auditing non-compliant deployments at the subscription level. RBAC only controls who can deploy, not what is deployed; Azure Blueprints packages templates but does not enforce their exclusive use.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 14

Your team uses GitHub and wants to automatically detect and block secrets pushed to repositories. Which GitHub feature should you enable?

Accepted Answer

Push protection. Push protection is the GitHub feature that automatically detects known types of secrets in pushed content and blocks the push, preventing exposure. Secret scanning, on the other hand, scans for secrets and alerts after they exist in the repository but does not block the push unless push protection is enabled. Since the requirement is to 'automatically detect and block secrets pushed', the feature to enable is Push protection.

Answer

Dependabot alerts

Answer

Code scanning

Answer

Secret scanning

Question 15

The exhibit shows a deployment job in an Azure Pipelines YAML file. The deployment fails with the error 'No package found with pattern: $(Pipeline.Workspace)/drop/*.zip'. What is the most likely cause?

Accepted Answer

The artifact is not downloaded to the expected path; the artifact name must be included in the path.. The error indicates the deployment job is looking for a .zip file in a folder named 'drop' directly under the pipeline workspace. However, in Azure Pipelines, artifacts are downloaded to a folder named after the artifact, and the published artifact contains a 'drop' folder inside it (or 'drop' is merely a folder, not the artifact name). The correct path must include the artifact name first, e.g., '$(Pipeline.Workspace)/<artifact-name>/drop/*.zip'. Option A correctly identifies that the artifact name is missing from the path.

Answer

The wildcard pattern '*.zip' is not supported.

Answer

The Azure service connection has expired.

Answer

The pipeline is using a Microsoft-hosted agent that does not support the download task.